[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fYF0HIektLMKc3E9O_JieqVqfCKtiipEIAVPo0gDh4DA":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":132},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":22,"category":23,"article_tags":27},"b062eb02-373d-4039-9675-6626d11c4d0a","EDR Evasion Stack Helps Process Injection Slip Past Defenses","edr-evasion-stack-helps-process-injection-slip-past-defenses-ce08fe","A process parameter-poisoning technique evades EDR by injecting code into process initialization structures without using the Windows APIs that EDR tools typically watch out for.","A novel technique for injecting code into running processes, dubbed 'process parameter poisoning,' has been identified. This method bypasses traditional Endpoint Detection and Response (EDR) solutions by manipulating process initialization structures without invoking common Windows APIs that EDR tools monitor, making it harder to detect.","New EDR evasion technique uses process parameter poisoning for code injection.","https:\u002F\u002Fwww.darkreading.com\u002Fendpoint-security\u002Fedr-evasion-stack-helps-process-injection-slip-past-defenses","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblt5729777b5599bc1e\u002F6ab427662474c510d68cbd53\u002Fspecial_agent_dark_corridor-Kemter-GettyImages-503113022.jpg?width=720&quality=80&disable=upscale","2026-09-23T21:03:01+00:00","2026-09-23T22:00:38.880493+00:00",7,[17,20],{"name":18,"type":19},"EDR","technology",{"name":21,"type":19},"Windows APIs","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":22,"icon":24,"name":25,"slug":26},null,"Vulnerabilities","vulnerabilities",[28,30,35,40],{"category":29},{"id":22,"icon":24,"name":25,"slug":26},{"category":31},{"id":32,"icon":24,"name":33,"slug":34},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":36},{"id":37,"icon":24,"name":38,"slug":39},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":41},{"id":42,"icon":24,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[],{"controls":48,"vendors":125},[49,75,96],{"slug":50,"name":51,"problem":52,"products":53},"breach-attack-simulation","Breach and attack simulation","You only find out whether your security tools stop an attack when a real attacker tries.",[54,62,70],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"attackiq","AttackIQ","\u002Fvendor-logos\u002Fattackiq.png","attackiq-ready","AttackIQ Ready","https:\u002F\u002Fwww.attackiq.com\u002Fproducts\u002Fready\u002F","Managed service that runs MITRE ATT&CK based emulations for you, with no scripting or tuning on your side.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"picus-security","Picus Security","\u002Fvendor-logos\u002Fpicus-security.png","picus-breach-and-attack-simulation","Picus Breach and Attack Simulation","https:\u002F\u002Fwww.picussecurity.com\u002Fplatform\u002Fbreach-and-attack-simulation","Continuously tests live defences against current threats, shows what controls block, detect, log and miss, and provides ready-to-apply fixes.",{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":71,"product_name":72,"url":73,"description":74},"attackiq-flex","AttackIQ Flex","https:\u002F\u002Fwww.attackiq.com\u002Fproducts\u002Fflex\u002F","Agentless, on-demand testing of security controls without deploying the full platform.",{"slug":76,"name":77,"problem":78,"products":79},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[80,88],{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":97,"name":98,"problem":99,"products":100},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[101,109,117],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",[126],{"slug":127,"name":128,"logo_path":129,"roles":130},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png",[131],"reported_by",{"slug":133,"title":134,"body":135,"framework_refs":136,"framework_notes":147},"process-parameter-poisoning-bypasses-edr-detection","Process Parameter Poisoning Bypasses EDR Detection","Attackers have developed a novel process injection technique called 'process parameter poisoning' that manipulates Windows process initialization structures (RTL_USER_PROCESS_PARAMETERS) without triggering the common API calls that EDR tools rely on to detect malicious activity. This exposes a fundamental weakness in signature- and API-hook-based detection strategies: if defenders only watch known-bad API calls, adversaries will simply route around them. The technique underscores that EDR solutions, while valuable, should never be treated as a complete defense in isolation. Organizations that rely solely on EDR for endpoint visibility are left blind to evasion techniques that operate below or beside monitored API layers. A layered, defense-in-depth posture combining behavioral analytics, memory scanning, and robust logging is essential to closing these gaps.",[137,138,139,140,141,142,143,144,145,146],"CIS Control 10: Malware Defenses","CIS Control 13: Network Monitoring and Defense","CIS Control 16: Application Software Security","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 SI-4: System Monitoring","NIST SP 800-53 CA-8: Penetration Testing","NIST CSF DE.CM-4: Malicious Code Detection","MITRE ATT&CK T1055: Process Injection","MITRE ATT&CK T1562.001: Impair Defenses – Disable or Modify Tools","ITIL: Continual Service Improvement – Security Monitoring Reviews",{}]